302 BIG-IP DNS Specialist Practice Questions
Prepare for 302 with more than an answer.
- Exam fee
- $180 USD
- Level
- Technology Specialist
- Valid for
- F5 certifications are valid for 2 years (F5-CTS ladders under the current F5 certification program).
Domains covered on the exam 3
- Concepts40%
- Deployment35%
- Operations and Troubleshooting25%
- 1
During a troubleshooting session, an administrator suspects that the F5 iQuery communication between a BIG-IP DNS and a BIG-IP LTM is failing due to SSL certificate issues. Which command-line tool is specifically designed to verify the SSL certificate exchange and test the iQuery connection between two BIG-IP devices?
Show answer details
Correct answer: C
The 'iqdump' utility is used to troubleshoot iQuery communication. It initiates an SSL connection to the big3d agent on a target BIG-IP device (port 4353), dumping the XML-formatted iQuery responses to standard output, making it ideal for verifying SSL handshakes and data exchange.
- 2
A telecommunications company is experiencing high CPU load on their BIG-IP DNS due to massive volumes of DNS queries for a large master zone managed by an external hidden master server. The architect decides to implement DNS Express. How does DNS Express change the way the BIG-IP system handles the zone data and queries compared to standard ZoneRunner/BIND?
Show answer details
Correct answer: B
DNS Express offloads DNS resolution from the local BIND (named) process. It performs an AXFR/IXFR from a master server and stores the zone data in the high-speed Traffic Management Microkernel (TMM) memory. This allows BIG-IP to answer authoritative queries significantly faster than sending them to the control plane BIND process.
flowchart LR Query[DNS Query] --> Express{DNS Express Enabled?} Express -->|Yes| RAM[In-Memory RAM DB in TMM] RAM --> Resp1[Fast Response] Express -->|No| BIND[Local BIND/ZoneRunner] BIND --> Resp2[Standard Response] - 3
An administrator creates a custom DNS profile and attaches it to a BIG-IP DNS Listener. The profile has 'Unhandled Query Action' set to 'Drop'. If a client queries the listener for a record that is neither a configured Wide IP nor present in any DNS Express zones, what will happen to the query?
Show answer details
Correct answer: B
The 'Unhandled Query Action' setting in the DNS profile dictates what TMM does with queries it cannot resolve via Wide IPs, DNS Express, or cache. Setting it to 'Drop' means the BIG-IP system will silently discard the packet. It will not forward it to BIND (which requires setting it to 'Allow' or checking 'Use BIND Server on BIG-IP').
- 4
Which of the following is a basic networking requirement for two BIG-IP devices to successfully communicate within a GTM sync group via the iQuery protocol?
Show answer details
Correct answer: A
iQuery operates over TCP port 4353. For a GTM sync group to function correctly, full mesh iQuery communication is required, meaning TCP port 4353 must be open and permitted bidirectionally between the self-IP addresses of all participating BIG-IP devices.
- 5
A financial enterprise is migrating its global application delivery infrastructure to F5 BIG-IP DNS. The architecture team needs to understand how DNS queries will flow from end users to the BIG-IP DNS listeners to ensure proper security and routing configurations.
The enterprise currently uses a mix of internal caching resolvers and external public DNS services. The security team has mandated that BIG-IP DNS must not perform recursive lookups for external domains to prevent potential DNS amplification attacks.
In a standard DNS query dataflow where a client queries a public domain hosted on the BIG-IP DNS, how does the BIG-IP DNS handle the resolution process, and what is the primary difference between iterative and recursive queries in this context?
Show answer details
Correct answer: B
In a standard DNS flow, the client asks its Local DNS (LDNS) to resolve a name recursively. The LDNS then performs iterative queries to the Root, TLD, and eventually the authoritative nameserver (the BIG-IP DNS). The BIG-IP DNS answers the iterative query authoritatively. It does not perform recursion for the client unless explicitly configured as a caching resolver.
- 6
A government agency requires all public-facing DNS zones to be secured using DNSSEC to prevent DNS spoofing and cache poisoning. When configuring BIG-IP DNS to sign these zones, which TWO of the following resource record types are automatically generated and used to establish the chain of trust and verify the authenticity of the response? (Select TWO)
Show answer details
Correct answer: A, C
RRSIG (Resource Record Signature) contains the cryptographic signature for a resource record set (RRset). It is generated during DNSSEC signing to prove authenticity.
DNSKEY holds the public key that resolvers use to verify the RRSIG signatures. Both RRSIG and DNSKEY are fundamental DNSSEC record types used in BIG-IP DNS implementations.
